Extracted

• • Target

    e027c84a599a945db6c231290042ed81_JaffaCakes118

  • Size

    1.1MB

  • MD5

    e027c84a599a945db6c231290042ed81

  • SHA1

    72387ee87b0f7088f43875be6a2570d3c6d10506

  • SHA256

    322800d88bf2237b00329b860f65bc577d10298c670cfff6fd9d4251db3ffa99

  • SHA512

    94a468cdc5c3d0ebd87fbd7e9ac3c73eaa0397eff0e8d2f14e1f50ea4bde9dea612b8992745ecec5bb27303a7799147c34ad5e70301287d3a067980fa045effd

  • SSDEEP

    24576:9wQdRHW/nSt1nQ3v0lNy5BdOKNzKFWYrYogfIEH:9ldR2/SvQcNy5lPf1H

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2